[php-src] PR #24725: Add a fuzzer for ext/uri
| From: | yumasansansan | Date: | Mon, 26 Oct 2026 07:29:52 +0000 |
| Subject: | [php-src] PR #24725: Add a fuzzer for ext/uri | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-39898@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24725
Author: yumasansansan
ext/uri (PHP 8.5) is always built, but no fuzzer targets it. In the OSS-Fuzz coverage
report of 2026-10-24, ext/uri/ (including the bundled uriparser) has 3.79% line
coverage (325/8569, 30/451 functions), ext/lexbor/ 0.61%, and
ext/standard/url.c 3.46%.
php-fuzz-uri:
- input: a URI, optionally followed by \n and a string for resolve() and
the with*() methods. The WHATWG parser removes tabs and newlines from its input, so
little is lost by using a newline as separator.
- Uri\Rfc3986\Uri::parse() and Uri\WhatWg\Url::parse() (the latter with
the $errors out parameter), then all getters,
toString()/toRawString() or
toAsciiString()/toUnicodeString(), __serialize(),
__debugInfo(), equals().
- resolve() and each with*() method with the second part of the input;
when they return an object, it is converted to a string.
- parse_url() with the URI.
- exceptions are discarded, so only sanitizer findings and assertions are reported.
- a seed corpus of 21 URIs in sapi/fuzzer/corpus/uri (picked up by the OSS-Fuzz
build.sh, which zips every directory in sapi/fuzzer/corpus).
Replaying only the seed corpus (no fuzzing) reaches 91 functions of the ext/uri glue code, 69
functions of the bundled uriparser and 44 functions of lexbor's URL parser.
ext/uri cannot be disabled, so the fuzzer is built unconditionally, like the JSON
fuzzer.